Remote Code Execution Vulnerability in Apache Doris JDBC Driver
CVE-2026-96443

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Doris
Vendor
CVE Published:
23 September 2026

What is CVE-2026-96443?

A vulnerability in Apache Doris arises from insufficient validation of the JDBC driver URL, enabling a privileged user to exploit this weakness and execute arbitrary code on the frontend (FE) component. This flaw highlights pressing security concerns regarding user input validation and overall system integrity.

Affected Version(s)

Apache Doris 2.0.5 <= 4.1.3

References

https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjo...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zhaoyudi (nebula LAB)
.